Menu
Menu
Blowfish is a cryptographic algorithm that was designed by Bruce Schneier in 1993. It is a fast, efficient, and highly secure symmetric key encryption cipher that operates on 64-bit blocks of data. Blowfish encryption is widely used in a variety of applications, including file encryption, network security, and database encryption, and is supported by many programming languages and cryptographic libraries.
By the end of 1993, a very awkward situation arose in the world of cryptography. The DES Data Encryption Standard algorithm, with its weak 56-bit symmetric encryption key, was close to a fiasco, and the alternatives that existed at that time, such as Khufu, REDOC II, IDEA, were patented and not available for free use.
Algorithms RC2 and RC4, developed at that time by RSA Security, also required a licensing procedure. And in general, the crypto industry within government organizations and large corporations has been turned towards the use of secret algorithms such as Skipjack.
What was needed was an encryption algorithm that was more crypto-resistant than the dying DES, and at the same time without any restrictions on the right to use it.
Blowfish is a 64-bit block cipher algorithm that allows a variable-length key, up to 448 bits encryption key. It was developed by a well-known specialist in the field of cryptography and information security Bruce Schneier in 1993.
In the general case, the algorithm consists of two stages – key expansion and encryption / decryption of the source data.
In the key expansion step, the original key is converted into a round key matrix (P) and a substitution matrix (S), totaling 4168 bytes. In all likelihood, this “extension” from 448 bits to 4168 bytes explains the choice of the name of the Blowfish encryption algorithm.
Data encryption, as well as the creation of a matrix of round keys and substitution, occurs through the use of the Feistel network, which in turn consists of 16 rounds.
The principle of operation of the Feistel cipher structure is quite simple:
The initial data is divided into blocks of a fixed length (usually a multiple of a power of two – 64 bits, 128 bits). If the length of the initial data block is less than the length of the cipher, then the block is supplemented in some known way.
The block is divided into two equal subblocks — the “left” L0 and the “right” R0.
In the case of 64-bit bit depth – into two blocks with a length of 32 bits each.
The “left subblock” L0 is modified by the iteration function F(L0, P0) depending on the key P0, after which it is added modulo 2 (XOR) with the “right subblock” R0.
The result of the addition is assigned to the new left subblock L1, which becomes the left half of the input for the next round, and the “left subblock” L0 is assigned unchanged to the new right subblock R1, which becomes the right half.
This operation is repeated n-1 times, while passing from one stage to another, the round keys change (P0, P1, P2, etc.), where n is the number of rounds for the algorithm used.
According to the author, the design criteria for the Blowfish were:
speed (encryption on 32-bit processors takes 26 cycles);
simplicity (due to the use of simple operations that reduce the probability of an error in the implementation of the encryption algorithm);
compactness (the ability to work in less than 5 KB of memory);
configurable security (changeable key length).
As noted earlier, the algorithm consists of two parts: key expansion and data encryption. During the key expansion step, the original key (up to 448 bits long) is converted into 18 32-bit subkeys and 4 32-bit S-boxes containing 256 elements. The total volume of received keys is 4168 bytes.
Both stages of the Blowfish algorithm are described in more detail below:
Decryption of the cyphertext is similar, only P(1) – P(18) are applied in reverse order.
Blowfish is a highly efficient and fast cryptographic algorithm that is ideal for applications that require high-speed encryption. It outperforms most other symmetric key ciphers in terms of speed and can encrypt and decrypt data quickly, making it a popular choice in a wide range of industries.
One of the reasons for Blowfish’s speed is its simplicity. It is a block cipher that operates on 64-bit blocks of data, which makes it easy to implement and efficient in terms of memory usage. Additionally, Blowfish uses a Feistel network, which is a structure that allows for parallel computation, further enhancing its speed.
Another factor contributing to Blowfish’s speed is its ability to support variable-length keys. Users can select a key size that is appropriate for their specific needs up to 448 bits encryption key, which can improve the algorithm’s efficiency and reduce processing time.
Blowfish is widely supported by many programming languages and cryptographic libraries, which makes it an easily integrable choice for existing applications and systems. Its popularity can be attributed to its fast and efficient performance, which is faster than most other symmetric key ciphers. It can encrypt and decrypt data quickly, making it an ideal choice for applications that require high-speed encryption.
Furthermore, Blowfish is an open-source algorithm, which means that its code is freely available for anyone to use and modify. This allows developers to customize the algorithm to meet their specific requirements, which is especially useful for applications that require unique security features.
It is not possible to determine in advance whether the key of the Blowfish algorithm is weak. You can check only after the key has been generated.
Cryptographic strength can be tuned by changing the number of encryption rounds – increasing the length of the array P – and the number of S-boxes used. By reducing the number of S-boxes used, the probability of weak keys increases, but the memory used decreases. By adapting Blowfish for 64-bit architecture, it is possible to increase the number and size of S-boxes, and the memory for arrays P and S, as well as complicate F(x), and the above attacks are impossible for an algorithm with such a cryptographic function F(x).
Blowfish’s use of a 64-bit block, as opposed to the 128-bit AES block, makes it vulnerable to birthday attacks, particularly in contexts like HTTPS. In 2016, the SWEET32 attack demonstrated how to use the birthday attack to recover plaintext from 64-bit blocks. The GnuPG project recommends not using Blowfish for files larger than 4 GB due to the small block size.
The reduced number of rounds Blowfish variant is known to be vulnerable to plaintext attacks on relatively weak keys. Blowfish implementations with 16 encryption rounds are not susceptible to such attacks. However, Bruce Schneier recommended switching to Blowfish’s successor, Twofish.
Blowfish has established itself as a reliable algorithm, therefore it is implemented in many programs where frequent key changes are not required and high encryption / decryption speed is needed:
In transport protocols like TLS while asymmetric encryption is used for authentication, symmetric encryption is used to secure the data transmitted over the network and Blowfish is still considered secure enough for that purpose, although AES-256 is preferred.
Blowfish is a reliable and versatile cryptographic algorithm that offers many advantages over other algorithms. Its speed, and flexibility make it a popular choice for securing sensitive information across multiple industries. With its widespread support, ease of use, and customizable features, Blowfish remains a widely-used and trusted algorithm for encrypting data. Helenix has many years of experience with the development of cryptographic solutions and security assesment. Learn more about our competencies in the Custom Development section.
Blowfish is a symmetric key block cipher that operates on 64-bit blocks of data. It uses a Feistel network and a key scheduling system to encrypt and decrypt data.
Blowfish and AES have their own strengths and weaknesses. While Blowfish is faster, AES is considered more secure and is recommended for most applications.
Despite being designed over two decades ago, Blowfish is still considered a secure algorithm. However, as computing power increases, its key size may become vulnerable to brute force attacks.
Blowfish is faster than AES due to its simplicity and use of a Feistel network. Additionally, Blowfish supports variable-length keys, which can improve its efficiency and reduce encryption processing time.
No, Blowfish is a block cipher algorithm used for encryption and decryption. It is not a hashing algorithm used for message integrity and authentication.